CVE-2022-23068CWE-74
ToolJet - HTML Injection in Invite New User
Medium · published May 18, 2022
What it is
ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail.
The record
Technical detail
- CVSS v3.1
- 5.4 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00615 · 48.8th percentile
- Weakness
- CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- Published
- 2022-05-18T11:45Z
EPSS history
Timeline